Malicious Mobile App Stole Over $1.8 Million in Cryptocurrency

A recent report by blockchain security firms SlowMist and OKX Web3 Security has uncovered a malicious mobile app that stole sensitive wallet data from users’ devices, resulting in the theft of over $1.8 million in cryptocurrency.

The Fake App: BOM

The app, called BOM, secretly accessed users’ private keys and mnemonic phrases to steal their crypto assets. The first unauthorized transactions with the app were noticed on February 14, and further analysis revealed that BOM was, in fact, a scam app that lured victims into giving file access.

Once the app was granted access, it scanned device storage, took wallet data, and sent it to a remote server. The app asked for unnecessary permissions, such as access to photos and media, which security experts deemed “highly suspicious” behavior.

“On iOS, the app first requests permissions, deceiving users with a message claiming the access is necessary for normal operation. This behavior is highly suspicious — as a blockchain-related application, it has no legitimate reason to require access to the photo gallery.”

Stolen Funds and Affected Victims

SlowMist tracked the stolen funds across multiple blockchains and estimated that the main hacker address stole assets from at least 13,000 victims. The funds were transferred through various blockchains, including BNB Chain, Ethereum, Polygon, Arbitrum, and Coinbase’s Base.

The stolen crypto included:

  • Tether (USDT)
  • Ethereum (ETH)
  • Wrapped Bitcoin (WBTC)
  • Dogecoin (DOGE)

Tips to Avoid Falling Victim to Similar Scams

To avoid falling victim to similar scams, it’s essential to be cautious when downloading mobile apps, especially those related to cryptocurrency and blockchain. Here are some tips to keep in mind:

  • Be wary of apps that request unnecessary permissions, such as access to photos and media.
  • Only download apps from reputable sources, such as official app stores.
  • Read reviews and check the app’s ratings before downloading.
  • Never give file access to unknown apps.

Stay informed about the latest developments in the cryptocurrency and blockchain space by following Global Crypto News.

Post Views: 1